From 5d64ca552ecc18f7f7c4e2349399a22a1f19dea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=94=D0=BC=D0=B8=D1=82=D1=80=D0=B8=D0=B9?= Date: Sat, 16 May 2026 19:52:31 +0300 Subject: [PATCH] =?UTF-8?q?test(import):=20Task=209=20code-review=20?= =?UTF-8?q?=E2=80=94=20cross-tenant=20=D1=82=D0=B5=D1=81=D1=82=20ImportCon?= =?UTF-8?q?troller::show?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Code-review Task 9 (🟡): добавлен тест защиты show() — пользователь одного тенанта получает 403 при запросе import_log другого тенанта (покрывает abort_if defense-in-depth в ImportController::show). phpstan-baseline регенерирован — инкремент count ложного TestCall-срабатывания (квирк 25). Co-Authored-By: Claude Opus 4.7 (1M context) --- app/phpstan-baseline.neon | 2 +- app/tests/Feature/Import/ImportControllerTest.php | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/app/phpstan-baseline.neon b/app/phpstan-baseline.neon index 08ba9bb8..d9069fba 100644 --- a/app/phpstan-baseline.neon +++ b/app/phpstan-baseline.neon @@ -1059,7 +1059,7 @@ parameters: - message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#' identifier: method.notFound - count: 3 + count: 4 path: tests/Feature/Import/ImportControllerTest.php - diff --git a/app/tests/Feature/Import/ImportControllerTest.php b/app/tests/Feature/Import/ImportControllerTest.php index 16e17370..949214e7 100644 --- a/app/tests/Feature/Import/ImportControllerTest.php +++ b/app/tests/Feature/Import/ImportControllerTest.php @@ -127,3 +127,16 @@ test('resolve отвергает несуществующий slug', function () 'mappings' => [['status_ru' => 'Архив', 'slug' => 'нет-такого']], ])->assertStatus(422); }); + +test('GET /api/imports/{id} отвергает import_log чужого тенанта (403)', function (): void { + $otherTenant = Tenant::factory()->create(); + $otherUser = User::factory()->for($otherTenant)->create(); + $foreignLog = ImportLog::factory()->create([ + 'tenant_id' => $otherTenant->id, + 'user_id' => $otherUser->id, + ]); + + // Авторизован пользователь $this->tenant; запрашиваем чужой import_log. + // abort_if(tenant_id mismatch, 403) в ImportController::show — defense-in-depth. + $this->getJson("/api/imports/{$foreignLog->id}")->assertStatus(403); +});